ThomasLloyd Group Hit by Cactus Ransomware Exposing 2.4 TB Data

Incident Date: Sep 17, 2024

Attack Overview
VICTIM
ThomasLloyd Group
INDUSTRY
Energy, Utilities & Waste
LOCATION
United Kingdom
ATTACKER
Cactus
FIRST REPORTED
September 17, 2024

ThomasLloyd Group Targeted by Cactus Ransomware: A Detailed Analysis

The ThomasLloyd Group, a prominent player in the sustainable investment and climate solutions sector, has recently fallen victim to a ransomware attack orchestrated by the Cactus ransomware group. This breach has resulted in the exfiltration of approximately 2.4 TB of sensitive data, significantly impacting the firm's operations and reputation.

About ThomasLloyd Group

Established in 2004 and headquartered in London, ThomasLloyd Group specializes in sustainable investment and climate solutions. The company focuses on the transition to renewable energy, providing a diverse portfolio of climate solutions aimed at governments, businesses, and individuals. Their core activities include investment management and advisory services, particularly targeting the German-speaking markets, and developing climate infrastructure projects such as biomass and solar power plants in the Philippines and India.

Despite their commitment to sustainability and impactful climate solutions, ThomasLloyd has faced significant financial challenges, including arrears on bond payments since 2020. The firm reported a turnover of £16.74 million for 2022, with total liabilities exceeding £110 million. These financial difficulties have raised concerns among investors regarding the company's viability.

Attack Overview

The Cactus ransomware group breached the USA branch of ThomasLloyd Group, resulting in the exfiltration of a wide array of sensitive information. The compromised data includes personally identifiable information (PII), personal data of employees and executives, corporate confidential documents, customer information, financial documents, corporate correspondence, and database backups. The attack has exposed vulnerabilities in ThomasLloyd's cybersecurity infrastructure, particularly in their VPN devices and data analytics platforms.

About Cactus Ransomware Group

Identified in March 2023, the Cactus ransomware group has quickly become a notable player in the ransomware landscape. The group employs sophisticated tactics, including exploiting vulnerabilities in VPN appliances and leveraging phishing attacks to gain initial access. Cactus ransomware is known for its double-extortion strategy, where they not only encrypt data but also threaten to leak sensitive information if the ransom is not paid.

The malware used by Cactus encrypts its own binary to evade detection by antivirus software, utilizing a combination of RSA and AES algorithms. Once inside a network, Cactus establishes command and control communications via SSH and uses Scheduled Tasks to maintain persistence. The group is recognized for its rapid adaptation to newly discovered vulnerabilities, making it a formidable threat in the cybersecurity landscape.

Penetration and Impact

The Cactus ransomware group likely penetrated ThomasLloyd's systems by exploiting known vulnerabilities in their VPN devices and data analytics platforms. The group's ability to encrypt its own binary and use various obfuscation techniques made it challenging for ThomasLloyd's security teams to detect and respond to the threat. The breach has not only compromised sensitive data but also highlighted the need for robust cybersecurity measures to protect against such sophisticated attacks.

Sources

See Halcyon in action

Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!

1
2
3
Let's get started
1
1
2
3
1
1
2
2
3
Back
Next
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.